Repository navigation
Conversation
MITRE marks CWE-730 as PROHIBITED for mapping real-world vulnerabilities. Remove the external/cwe/cwe-730 tag from all queries and add change notes. Query paths and suite expectations are unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The six change notes need the documented metadata category to select the correct release classification and version-bump behavior.
1 open issue
What changed in this PR
Removes the prohibited CWE-730 vulnerability mapping from CodeQL query metadata across six languages, addressing #22318.
Changes:
- Removes
external/cwe/cwe-730from 19 queries, including the experimental JavaScript query. - Preserves query logic, IDs, paths, and other CWE tags.
- Adds six language-specific change notes.
| File | Description |
|---|---|
swift/ql/src/queries/Security/CWE-730/RegexInjection.ql |
Removes CWE-730 from regex-injection metadata. |
swift/ql/src/queries/Security/CWE-1333/ReDoS.ql |
Removes CWE-730 from ReDoS metadata. |
swift/ql/src/change-notes/2026-10-21-remove-cwe-730.md |
Documents Swift tag removals. |
ruby/ql/src/queries/security/cwe-1333/RegExpInjection.ql |
Removes CWE-730 from regex-injection metadata. |
ruby/ql/src/queries/security/cwe-1333/ReDoS.ql |
Removes CWE-730 from ReDoS metadata. |
ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql |
Removes CWE-730 from polynomial ReDoS metadata. |
ruby/ql/src/change-notes/2026-10-21-remove-cwe-730.md |
Documents Ruby tag removals. |
python/ql/src/Security/CWE-730/RegexInjection.ql |
Removes CWE-730 from regex-injection metadata. |
python/ql/src/Security/CWE-730/ReDoS.ql |
Removes CWE-730 from ReDoS metadata. |
python/ql/src/Security/CWE-730/PolynomialReDoS.ql |
Removes CWE-730 from polynomial ReDoS metadata. |
python/ql/src/change-notes/2026-10-21-remove-cwe-730.md |
Documents Python tag removals. |
javascript/ql/src/Security/CWE-834/LoopBoundInjection.ql |
Removes CWE-730 from loop-bound injection metadata. |
javascript/ql/src/Security/CWE-730/ServerCrash.ql |
Removes CWE-730 from server-crash metadata. |
javascript/ql/src/Security/CWE-730/RegExpInjection.ql |
Removes CWE-730 from regex-injection metadata. |
javascript/ql/src/Performance/ReDoS.ql |
Removes CWE-730 from ReDoS metadata. |
javascript/ql/src/Performance/PolynomialReDoS.ql |
Removes CWE-730 from polynomial ReDoS metadata. |
javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-730/RegExpInjection.ql |
Removes CWE-730 from experimental query metadata. |
javascript/ql/src/change-notes/2026-10-21-remove-cwe-730.md |
Documents JavaScript tag removals. |
java/ql/src/Security/CWE/CWE-730/RegexInjection.ql |
Removes CWE-730 from regex-injection metadata. |
java/ql/src/Security/CWE/CWE-730/ReDoS.ql |
Removes CWE-730 from ReDoS metadata. |
java/ql/src/Security/CWE/CWE-730/PolynomialReDoS.ql |
Removes CWE-730 from polynomial ReDoS metadata. |
java/ql/src/change-notes/2026-10-21-remove-cwe-730.md |
Documents Java tag removals. |
csharp/ql/src/Security Features/CWE-730/RegexInjection.ql |
Removes CWE-730 from regex-injection metadata. |
csharp/ql/src/Security Features/CWE-730/ReDoS.ql |
Removes CWE-730 from ReDoS metadata. |
csharp/ql/src/change-notes/2026-10-21-remove-cwe-730.md |
Documents C# tag removals. |
Review effort: Max
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
geoffw0
approved these changes
Oct 22, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #22318.
MITRE marks CWE-730 as a prohibited category for vulnerability mapping. This removes the
external/cwe/cwe-730tag from all 19 queries (C#, Java, JavaScript, Python, Ruby, Swift) and addsqueryMetadatachange notes. Other CWE tags are retained; query paths are unchanged.